@dereekb/dbx-cli 14.3.0 → 14.4.0

package/index.esm.js

@@ -1,15 +1,13 @@
 import { existsSync, mkdirSync, writeFileSync, readFileSync, statSync, appendFileSync } from 'node:fs';
 import { join, dirname, resolve, sep, basename, relative, posix, isAbsolute, parse } from 'node:path';
-import { clientFirebaseFirestoreContextFactory, makeFirestoreCollectionGroup, addOrReplaceLimitInConstraints, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPE_PREFIX, STORAGE_FILE_UPLOAD_USER_ROLE } from '@dereekb/firebase';
+import { makeFirestoreCollectionGroup, addOrReplaceLimitInConstraints, CALL_MODEL_OIDC_SCOPES, CALL_MODEL_OIDC_SCOPE_FOR_CALL_TYPE, CALL_MODEL_MISSING_OIDC_SCOPE_ERROR_CODE, CALL_MODEL_OIDC_SCOPE_PREFIX, STORAGE_FILE_UPLOAD_USER_ROLE } from '@dereekb/firebase';
 export { CALL_MODEL_APP_FUNCTION_KEY } from '@dereekb/firebase';
 import { createRequire } from 'node:module';
-import { Firestore, getFirestore, connectFirestoreEmulator } from 'firebase/firestore';
-import { getApps, initializeApp, deleteApp } from 'firebase/app';
-import { initializeAppCheck, CustomProvider } from 'firebase/app-check';
-import { signInWithCustomToken, getAuth, connectAuthEmulator } from 'firebase/auth';
-import { expirationDetails, performAsyncTasks, compareStrings, OidcRelyingPartyError, buildAuthorizationUrl as buildAuthorizationUrl$1, parseAuthorizationRedirect, noop, generateOAuthState, MS_IN_SECOND, generatePkceMaterial, isPlainObject as isPlainObject$1, MS_IN_HOUR, asArray, buildOidcDiscoveryCandidates, unique, AUTH_TOS_SIGNED_ROLE, AUTH_ONBOARDED_ROLE, AUTH_ADMIN_ROLE, AUTH_USER_ROLE } from '@dereekb/util';
-import { createMemoizedJsonFileAsyncKeyedValueCache, readJsonFile, writeJsonFile, DEFAULT_JSON_FILE_CACHE_MODE, removeFile } from '@dereekb/nestjs';
+import { CLIENT_FIRESTORE_DRIVER_IDENTIFIER, firebaseClientFirestoreIdentitySuggestion, inspectFirebaseClientFirestoreIdentity, fetchFirestoreSession as fetchFirestoreSession$1, DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST, firebaseClientEmulatorsInUse, isFirebaseClientConfigComplete, openFirebaseUserSession, closeFirebaseUserSession, closeFirebaseUserSessionApps, FIRESTORE_SESSION_EXPIRY_BUFFER_MS, FIRESTORE_SESSION_MAX_CACHE_MS, firestoreSessionEntryExpiresAt, isFirestoreSessionExpired } from '@dereekb/oauth-resource/firebase';
+export { FIRESTORE_SESSION_API_PATH } from '@dereekb/oauth-resource/firebase';
+import { performAsyncTasks, compareStrings, expirationDetails, OidcRelyingPartyError, buildAuthorizationUrl as buildAuthorizationUrl$1, parseAuthorizationRedirect, noop, generateOAuthState, MS_IN_SECOND, generatePkceMaterial, isPlainObject as isPlainObject$1, MS_IN_HOUR, asArray, buildOidcDiscoveryCandidates, unique, AUTH_TOS_SIGNED_ROLE, AUTH_ONBOARDED_ROLE, AUTH_ADMIN_ROLE, AUTH_USER_ROLE } from '@dereekb/util';
 import { durationDataToMilliseconds, parseDurationString } from '@dereekb/date';
+import { readJsonFile, writeJsonFile, createMemoizedJsonFileAsyncKeyedValueCache, DEFAULT_JSON_FILE_CACHE_MODE, removeFile } from '@dereekb/nestjs';
 import { homedir } from 'node:os';
 import { discoverOidcMetadata as discoverOidcMetadata$1, exchangeAuthorizationCode as exchangeAuthorizationCode$1, refreshAccessToken as refreshAccessToken$1, revokeToken as revokeToken$1, fetchUserInfo as fetchUserInfo$1, fetchSessionInfo as fetchSessionInfo$1 } from '@dereekb/util/oidc';
 import { createServer } from 'node:http';
@@ -117,7 +115,7 @@ function _inherits(subClass, superClass) {
     });
     if (superClass) _set_prototype_of(subClass, superClass);
 }
-function _instanceof$y(left, right) {
+function _instanceof$x(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
@@ -157,7 +155,7 @@ function _object_spread$10(target) {
     }
     return target;
 }
-function ownKeys$I(object, enumerableOnly) {
+function ownKeys$H(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -165,18 +163,18 @@ function ownKeys$I(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$I(target, source) {
+function _object_spread_props$H(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$I(Object(source)).forEach(function(key) {
+        ownKeys$H(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
     return target;
 }
 function _possible_constructor_return(self, call) {
-    if (call && (_type_of$8(call) === "object" || typeof call === "function")) return call;
+    if (call && (_type_of$7(call) === "object" || typeof call === "function")) return call;
     return _assert_this_initialized(self);
 }
 function _set_prototype_of(o, p) {
@@ -288,7 +286,7 @@ function _ts_generator$1u(thisArg, body) {
         };
     }
 }
-function _type_of$8(obj) {
+function _type_of$7(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
@@ -420,7 +418,7 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
                     method = (_ref = init === null || init === void 0 ? void 0 : init.method) !== null && _ref !== void 0 ? _ref : 'GET';
                     if (typeof input === 'string') {
                         url = input;
-                    } else if (_instanceof$y(input, URL)) {
+                    } else if (_instanceof$x(input, URL)) {
                         url = input.toString();
                     } else {
                         url = input.url;
@@ -434,7 +432,7 @@ var _timeoutMs = DEFAULT_CLI_HTTP_TIMEOUT_MS;
                             return localController.abort();
                         }, timeoutMs);
                         (_timeoutHandle_unref = timeoutHandle.unref) === null || _timeoutHandle_unref === void 0 ? void 0 : _timeoutHandle_unref.call(timeoutHandle);
-                        finalInit = _object_spread_props$I(_object_spread$10({}, init), {
+                        finalInit = _object_spread_props$H(_object_spread$10({}, init), {
                             signal: localController.signal
                         });
                     }
@@ -621,7 +619,7 @@ function dumpResponse(data, meta) {
         result = data.map(function(item) {
             return pickFromObject(item, fields);
         });
-    } else if (data != null && (typeof data === "undefined" ? "undefined" : _type_of$8(data)) === 'object') {
+    } else if (data != null && (typeof data === "undefined" ? "undefined" : _type_of$7(data)) === 'object') {
         result = pickFromObject(data, fields);
     } else {
         result = data;
@@ -630,7 +628,7 @@ function dumpResponse(data, meta) {
 }
 function pickFromObject(obj, fields) {
     var result;
-    if (obj == null || (typeof obj === "undefined" ? "undefined" : _type_of$8(obj)) !== 'object') {
+    if (obj == null || (typeof obj === "undefined" ? "undefined" : _type_of$7(obj)) !== 'object') {
         result = obj;
     } else {
         var picked = {};
@@ -731,7 +729,7 @@ function stringifyEnvelope(value) {
     var result;
     if (mapped) {
         result = mapped;
-    } else if (_instanceof$y(error, CliError)) {
+    } else if (_instanceof$x(error, CliError)) {
         result = _object_spread$10({
             ok: false,
             error: sanitizeString(error.message),
@@ -739,7 +737,7 @@ function stringifyEnvelope(value) {
         }, error.suggestion ? {
             suggestion: error.suggestion
         } : {});
-    } else if (_instanceof$y(error, Error)) {
+    } else if (_instanceof$x(error, Error)) {
         result = {
             ok: false,
             error: sanitizeString(error.message),
@@ -823,7 +821,7 @@ function _object_spread$$(target) {
     }
     return target;
 }
-function ownKeys$H(object, enumerableOnly) {
+function ownKeys$G(object, enumerableOnly) {
     var keys = Object.keys(object);
     if (Object.getOwnPropertySymbols) {
         var symbols = Object.getOwnPropertySymbols(object);
@@ -831,11 +829,11 @@ function ownKeys$H(object, enumerableOnly) {
     }
     return keys;
 }
-function _object_spread_props$H(target, source) {
+function _object_spread_props$G(target, source) {
     source = source != null ? source : {};
     if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
     else {
-        ownKeys$H(Object(source)).forEach(function(key) {
+        ownKeys$G(Object(source)).forEach(function(key) {
             Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
         });
     }
@@ -943,7 +941,7 @@ function _ts_generator$1t(thisArg, body) {
         };
     }
 }
-function _type_of$7(obj) {
+function _type_of$6(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
@@ -975,7 +973,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                 2,
                 requestJson({
                     method: 'POST',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
+                    url: "".concat(trimSlash(input.apiBaseUrl)).concat(CALL_MODEL_API_PATH),
                     accessToken: input.accessToken,
                     jsonBody: input.params,
                     fetcher: input.fetcher,
@@ -1004,7 +1002,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                 2,
                 requestJson({
                     method: 'GET',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
+                    url: "".concat(trimSlash(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get?key=").concat(encodeURIComponent(input.key)),
                     accessToken: input.accessToken,
                     fetcher: input.fetcher,
                     errorPrefix: "get ".concat(input.modelType, "/").concat(input.key, " failed")
@@ -1045,7 +1043,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                 2,
                 requestJson({
                     method: 'POST',
-                    url: "".concat(trimSlash$1(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
+                    url: "".concat(trimSlash(input.apiBaseUrl), "/model/").concat(encodeURIComponent(input.modelType), "/get"),
                     accessToken: input.accessToken,
                     jsonBody: {
                         keys: input.keys
@@ -1102,7 +1100,7 @@ var MAX_MODEL_ACCESS_MULTI_READ_KEYS = 50;
                     chunk = _step.value;
                     return [
                         4,
-                        getMultipleModelsOverHttp(_object_spread_props$H(_object_spread$$({}, input), {
+                        getMultipleModelsOverHttp(_object_spread_props$G(_object_spread$$({}, input), {
                             keys: chunk
                         }))
                     ];
@@ -1187,8 +1185,8 @@ function requestJson(input) {
                     _ref = _state.sent(), ok = _ref.ok, body = _ref.body, fallbackMessage = _ref.fallbackMessage;
                     if (!ok) {
                         throw new CliError({
-                            message: "".concat(input.errorPrefix, ": ").concat(extractMessage$1(body, fallbackMessage, res)),
-                            code: codeForStatus$1(res.status),
+                            message: "".concat(input.errorPrefix, ": ").concat(extractMessage(body, fallbackMessage, res)),
+                            code: codeForStatus(res.status),
                             suggestion: res.status === 401 || res.status === 403 ? 'Run `<cli> auth login` to refresh credentials.' : undefined
                         });
                     }
@@ -1231,12 +1229,12 @@ function readJsonResponse(res) {
         });
     })();
 }
-function extractMessage$1(body, fallback, res) {
-    var bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of$7(body)) === 'object' && body && 'message' in body ? body.message : undefined;
+function extractMessage(body, fallback, res) {
+    var bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of$6(body)) === 'object' && body && 'message' in body ? body.message : undefined;
     var messageString = typeof bodyMessage === 'string' ? bodyMessage : undefined;
     return messageString !== null && messageString !== void 0 ? messageString : fallback || "".concat(res.status, " ").concat(res.statusText);
 }
-function codeForStatus$1(status) {
+function codeForStatus(status) {
     var result;
     if (status === 401) {
         result = 'AUTH_UNAUTHORIZED';
@@ -1255,68 +1253,20 @@ function codeForStatus$1(status) {
     }
     return result;
 }
-function trimSlash$1(url) {
+function trimSlash(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
 
-function _define_property$$(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else obj[key] = value;
-    return obj;
-}
-function _instanceof$x(left, right) {
+function _instanceof$w(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
     } else return left instanceof right;
 }
-function _object_spread$_(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
-        }
-        ownKeys.forEach(function(key) {
-            _define_property$$(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function ownKeys$G(object, enumerableOnly) {
-    var keys = Object.keys(object);
-    if (Object.getOwnPropertySymbols) {
-        var symbols = Object.getOwnPropertySymbols(object);
-        keys.push.apply(keys, symbols);
-    }
-    return keys;
-}
-function _object_spread_props$G(target, source) {
-    source = source != null ? source : {};
-    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
-    else {
-        ownKeys$G(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
-        });
-    }
-    return target;
-}
 /**
- * The `drivers.firestoreDriverIdentifier` a client-SDK `FirestoreContext` reports.
- *
- * `clientFirebaseFirestoreContextFactory` stamps this; the server's
- * `googleCloudFirestoreContextFactory` stamps `@google-cloud/firestore` instead. Comparing against
- * it is how {@link inspectCliFirestoreSdkIdentity} tells an admin-SDK context handed to the CLI apart
- * from a genuinely broken client one.
- */ var CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER = '@firebase/firestore';
+ * The `drivers.firestoreDriverIdentifier` a client-SDK `FirestoreContext` reports. See
+ * {@link CLIENT_FIRESTORE_DRIVER_IDENTIFIER}.
+ */ var CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER = CLIENT_FIRESTORE_DRIVER_IDENTIFIER;
 /**
  * The doctor `detail.stage` reported when the session's Firestore handle is not a usable client-SDK
  * `Firestore`.
@@ -1328,54 +1278,43 @@ function _object_spread_props$G(target, source) {
  * `CliError` code for a Firestore handle the client SDK does not recognize as its own.
  */ var FIRESTORE_SDK_INSTANCE_MISMATCH_CODE = 'FIRESTORE_SDK_INSTANCE_MISMATCH';
 /**
- * Checks that a session's Firestore handle is one THIS copy of the client SDK will accept, and
- * reports where every consumer resolved the SDK from.
+ * `CliError` code for a collection/document reference the SDK refused to build for a reason the
+ * wiring identity check cannot explain — a bad `--parent`, or an app collection whose own
+ * construction is broken.
+ */ var FIRESTORE_COLLECTION_UNRESOLVABLE_CODE = 'FIRESTORE_COLLECTION_UNRESOLVABLE';
+/**
+ * The CLI's name in the SDK-identity report and its suggestions.
+ */ var CLI_FIRESTORE_IDENTITY_CONSUMER_NAME = '@dereekb/dbx-cli';
+/**
+ * This package's own module-resolution root.
  *
- * Exists because `collection()` refuses any non-`Firestore` first argument with one message —
- * `Expected first argument to collection() to be a CollectionReference, a DocumentReference or
- * FirebaseFirestore` — that names neither the model, nor the collection, nor which of the three
- * distinct causes ({@link CliFirestoreSdkIdentityProblem}) produced it. Every downstream CLI built on
- * `@dereekb/dbx-cli` shares that hazard, so the diagnosis belongs here rather than in an app.
+ * The duplicated-SDK hypothesis is exactly "do `@dereekb/dbx-cli` and `@dereekb/firebase` see the
+ * same copy of `@firebase/firestore`", so the resolution has to start from HERE — resolving from
+ * `@dereekb/oauth-resource/firebase` would answer a different question.
+ */ var cliRequire = createRequire(import.meta.url);
+/**
+ * The CLI's operator-facing remediation for each problem, replacing the package-level default.
  *
- * The `instanceof` test is the load-bearing one and it is deliberately NOT structural: an identity
- * check across the package boundary is the only thing that can detect a duplicated
- * `@firebase/firestore`, which is exactly what a structural check would hide. (Contrast
- * `firestore.error.ts`, which narrows a thrown `FirebaseError` structurally — there the goal is to
- * classify an error even when copies differ, so the tradeoff runs the other way.)
+ * Each names a step an operator of a `@dereekb/dbx-cli`-built CLI can actually take.
+ */ var CLI_FIRESTORE_SDK_IDENTITY_SUGGESTIONS = {
+    'no-firestore-handle': 'The session produced no Firestore handle, so every collection reference built from it fails. This is a wiring fault, not a rules or App Check fault — re-run with `--verbose` to see the handshake, and verify the CLI resolves ONE `@dereekb/firebase`.',
+    'foreign-firestore-instance': "The session's handle is not an instance of the loaded SDK's `Firestore`, and only one copy of `@firebase/firestore` is installed. The likeliest cause is a STALE CLI artifact running against a newer `@dereekb/*` in `node_modules` — rebuild the CLI, then re-run `doctor`."
+};
+/**
+ * Checks that a session's Firestore handle is one the loaded client SDK will accept, and reports
+ * where every consumer resolved the SDK from.
+ *
+ * The CLI wrapper over {@link inspectFirebaseClientFirestoreIdentity}: it supplies this package's own
+ * `require` as the resolution root and names the CLI in the report, so `doctor`'s output is unchanged
+ * by the move of the inspection core into `@dereekb/oauth-resource/firebase`.
  *
  * @param input - The session's `firestoreContext`, when one was built.
  * @returns The provenance + brand-check report.
  */ function inspectCliFirestoreSdkIdentity(input) {
-    var _input_firestoreContext, _input_firestoreContext_drivers, _input_firestoreContext1;
-    var firestore = (_input_firestoreContext = input.firestoreContext) === null || _input_firestoreContext === void 0 ? void 0 : _input_firestoreContext.firestore;
-    var driverIdentifier = (_input_firestoreContext1 = input.firestoreContext) === null || _input_firestoreContext1 === void 0 ? void 0 : (_input_firestoreContext_drivers = _input_firestoreContext1.drivers) === null || _input_firestoreContext_drivers === void 0 ? void 0 : _input_firestoreContext_drivers.firestoreDriverIdentifier;
-    var firestoreDriverIdentifier = typeof driverIdentifier === 'string' ? driverIdentifier : undefined;
-    var firestorePresent = firestore != null;
-    var firestoreIsSdkInstance = _instanceof$x(firestore, Firestore);
-    var firestoreConstructor = firestoreConstructorName(firestore);
-    var modules = resolveCliFirestoreSdkModules();
-    var sdkDuplicated = modules.sdkFromDbxCli.packageDir != null && modules.sdkFromDbxFirebase.packageDir != null && modules.sdkFromDbxCli.packageDir !== modules.sdkFromDbxFirebase.packageDir;
-    var problem;
-    if (!firestorePresent) {
-        problem = 'no-firestore-handle';
-    } else if (firestoreDriverIdentifier != null && firestoreDriverIdentifier !== CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER) {
-        problem = 'unexpected-driver';
-    } else if (!firestoreIsSdkInstance) {
-        problem = sdkDuplicated ? 'duplicated-firestore-sdk' : 'foreign-firestore-instance';
-    }
-    return _object_spread_props$G(_object_spread$_(_object_spread_props$G(_object_spread$_({
-        ok: problem == null
-    }, problem == null ? {} : {
-        problem: problem
-    }), {
-        firestorePresent: firestorePresent,
-        firestoreIsSdkInstance: firestoreIsSdkInstance
-    }), firestoreConstructor == null ? {} : {
-        firestoreConstructor: firestoreConstructor
-    }, firestoreDriverIdentifier == null ? {} : {
-        firestoreDriverIdentifier: firestoreDriverIdentifier
-    }, modules), {
-        sdkDuplicated: sdkDuplicated
+    return inspectFirebaseClientFirestoreIdentity({
+        firestoreContext: input.firestoreContext,
+        consumerRequire: cliRequire,
+        consumerName: CLI_FIRESTORE_IDENTITY_CONSUMER_NAME
     });
 }
 /**
@@ -1390,32 +1329,8 @@ function _object_spread_props$G(target, source) {
  *
  * @__NO_SIDE_EFFECTS__
  */ function cliFirestoreSdkIdentitySuggestion(report) {
-    var result;
-    switch(report.problem){
-        case 'no-firestore-handle':
-            result = 'The session produced no Firestore handle, so every collection reference built from it fails. This is a wiring fault, not a rules or App Check fault — re-run with `--verbose` to see the handshake, and verify the CLI resolves ONE `@dereekb/firebase`.';
-            break;
-        case 'unexpected-driver':
-            result = 'The `FirestoreContext` reports driver "'.concat(report.firestoreDriverIdentifier, '", not "').concat(CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, "\". An admin-SDK context reached the client-SDK read path — build the CLI's context with `clientFirebaseFirestoreContextFactory`, not `googleCloudFirestoreContextFactory`.");
-            break;
-        case 'duplicated-firestore-sdk':
-            result = "Two copies of `@firebase/firestore` are loaded — `@dereekb/dbx-cli` resolves ".concat(report.sdkFromDbxCli.packageDir, ", `@dereekb/firebase` resolves ").concat(report.sdkFromDbxFirebase.packageDir, " — so the handle one minted fails the other's brand check. Dedupe the install (`npm ls @firebase/firestore`) and rebuild the CLI.");
-            break;
-        case 'foreign-firestore-instance':
-            var _report_firestoreConstructor;
-            result = "The session's handle (`".concat((_report_firestoreConstructor = report.firestoreConstructor) !== null && _report_firestoreConstructor !== void 0 ? _report_firestoreConstructor : 'unknown', "`) is not an instance of the loaded SDK's `Firestore`, and only one copy of `@firebase/firestore` is installed. The likeliest cause is a STALE CLI artifact running against a newer `@dereekb/*` in `node_modules` — rebuild the CLI, then re-run `doctor`.");
-            break;
-        default:
-            result = undefined;
-            break;
-    }
-    return result;
+    return firebaseClientFirestoreIdentitySuggestion(report, CLI_FIRESTORE_SDK_IDENTITY_SUGGESTIONS, CLI_FIRESTORE_IDENTITY_CONSUMER_NAME);
 }
-/**
- * `CliError` code for a collection/document reference the SDK refused to build for a reason the
- * wiring identity check cannot explain — a bad `--parent`, or an app collection whose own
- * construction is broken.
- */ var FIRESTORE_COLLECTION_UNRESOLVABLE_CODE = 'FIRESTORE_COLLECTION_UNRESOLVABLE';
 /**
  * Re-raises a reference-construction failure as a `CliError` that names WHAT was being built and, when
  * the SDK handle is at fault, WHY.
@@ -1431,10 +1346,10 @@ function _object_spread_props$G(target, source) {
  */ function cliFirestoreWiringError(input) {
     var error = input.error, operation = input.operation, modelType = input.modelType, collectionName = input.collectionName, parentKey = input.parentKey, firestoreContext = input.firestoreContext;
     var result;
-    if (_instanceof$x(error, CliError)) {
+    if (_instanceof$w(error, CliError)) {
         result = error;
     } else {
-        var _cliFirestoreSdkIdentitySuggestion, _report_firestoreDriverIdentifier, _report_sdkFromDbxCli_version, _report_sdkFromDbxCli_packageDir;
+        var _cliFirestoreSdkIdentitySuggestion, _report_firestoreDriverIdentifier, _report_sdkFromConsumer_version, _report_sdkFromConsumer_packageDir;
         var facts = [
             modelType == null ? undefined : 'model "'.concat(modelType, '"'),
             collectionName == null ? undefined : 'collection "'.concat(collectionName, '"'),
@@ -1445,96 +1360,15 @@ function _object_spread_props$G(target, source) {
         var report = inspectCliFirestoreSdkIdentity({
             firestoreContext: firestoreContext
         });
-        var message = "Could not ".concat(operation, " (").concat(facts.join(', '), "): ").concat(_instanceof$x(error, Error) ? error.message : String(error));
+        var message = "Could not ".concat(operation, " (").concat(facts.join(', '), "): ").concat(_instanceof$w(error, Error) ? error.message : String(error));
         result = new CliError({
             message: message,
             code: report.ok ? FIRESTORE_COLLECTION_UNRESOLVABLE_CODE : FIRESTORE_SDK_INSTANCE_MISMATCH_CODE,
-            suggestion: (_cliFirestoreSdkIdentitySuggestion = cliFirestoreSdkIdentitySuggestion(report)) !== null && _cliFirestoreSdkIdentitySuggestion !== void 0 ? _cliFirestoreSdkIdentitySuggestion : 'The Firestore handle itself checked out (driver "'.concat((_report_firestoreDriverIdentifier = report.firestoreDriverIdentifier) !== null && _report_firestoreDriverIdentifier !== void 0 ? _report_firestoreDriverIdentifier : 'unknown', '", @firebase/firestore ').concat((_report_sdkFromDbxCli_version = report.sdkFromDbxCli.version) !== null && _report_sdkFromDbxCli_version !== void 0 ? _report_sdkFromDbxCli_version : 'unknown', " at ").concat((_report_sdkFromDbxCli_packageDir = report.sdkFromDbxCli.packageDir) !== null && _report_sdkFromDbxCli_packageDir !== void 0 ? _report_sdkFromDbxCli_packageDir : 'unknown', "), so the rejected argument is the path, not the SDK. Check the --parent key and the app's collection factory for this model.")
-        });
-    }
-    return result;
-}
-/**
- * The handle's constructor name, when it has one.
- *
- * @param firestore - The candidate handle.
- * @returns The constructor name, or `undefined`.
- */ function firestoreConstructorName(firestore) {
-    var _firestore_constructor;
-    var name = firestore == null ? undefined : (_firestore_constructor = firestore.constructor) === null || _firestore_constructor === void 0 ? void 0 : _firestore_constructor.name;
-    return typeof name === 'string' ? name : undefined;
-}
-/**
- * Resolves `@firebase/firestore` from both this package and `@dereekb/firebase`, plus the `firebase`
- * umbrella version.
- *
- * `createRequire` rather than `import.meta.resolve` because the resolution has to be performed
- * relative to ANOTHER package's location (`@dereekb/firebase`'s entry file) to answer the question
- * that matters — whether the two consumers see the same copy.
- *
- * @returns The two module identities and the umbrella version, each degrading to an `error` field
- *   rather than throwing: this runs inside a diagnostic, and a failed resolution is itself a finding.
- */ function resolveCliFirestoreSdkModules() {
-    var requireFromDbxCli = createRequire(import.meta.url);
-    var sdkFromDbxCli = resolveFirestoreSdkIdentity(requireFromDbxCli);
-    var sdkFromDbxFirebase;
-    try {
-        sdkFromDbxFirebase = resolveFirestoreSdkIdentity(createRequire(requireFromDbxCli.resolve('@dereekb/firebase')));
-    } catch (e) {
-        sdkFromDbxFirebase = {
-            error: _instanceof$x(e, Error) ? e.message : String(e)
-        };
-    }
-    var firebaseVersion;
-    try {
-        firebaseVersion = readPackageVersion(requireFromDbxCli, 'firebase/package.json');
-    } catch (unused) {
-        // the umbrella version is context for the report, not a finding on its own
-        firebaseVersion = undefined;
-    }
-    return _object_spread$_({
-        sdkFromDbxCli: sdkFromDbxCli,
-        sdkFromDbxFirebase: sdkFromDbxFirebase
-    }, firebaseVersion == null ? {} : {
-        firebaseVersion: firebaseVersion
-    });
-}
-/**
- * Resolves `@firebase/firestore`'s package directory + version through one `require`.
- *
- * Resolves `package.json` rather than the package entry because the entry differs per export
- * condition (`index.node.cjs.js` vs `index.node.mjs`), which would report two copies where there is
- * one. The `package.json` path is condition-independent, so its directory is a stable identity.
- *
- * @param resolver - The `require` to resolve through.
- * @returns The module identity, with `error` set when resolution failed.
- */ function resolveFirestoreSdkIdentity(resolver) {
-    var result;
-    try {
-        var packageJsonPath = resolver.resolve('@firebase/firestore/package.json');
-        var version = readPackageVersion(resolver, '@firebase/firestore/package.json');
-        result = _object_spread$_({
-            packageDir: dirname(packageJsonPath)
-        }, version == null ? {} : {
-            version: version
+            suggestion: (_cliFirestoreSdkIdentitySuggestion = cliFirestoreSdkIdentitySuggestion(report)) !== null && _cliFirestoreSdkIdentitySuggestion !== void 0 ? _cliFirestoreSdkIdentitySuggestion : 'The Firestore handle itself checked out (driver "'.concat((_report_firestoreDriverIdentifier = report.firestoreDriverIdentifier) !== null && _report_firestoreDriverIdentifier !== void 0 ? _report_firestoreDriverIdentifier : 'unknown', '", @firebase/firestore ').concat((_report_sdkFromConsumer_version = report.sdkFromConsumer.version) !== null && _report_sdkFromConsumer_version !== void 0 ? _report_sdkFromConsumer_version : 'unknown', " at ").concat((_report_sdkFromConsumer_packageDir = report.sdkFromConsumer.packageDir) !== null && _report_sdkFromConsumer_packageDir !== void 0 ? _report_sdkFromConsumer_packageDir : 'unknown', "), so the rejected argument is the path, not the SDK. Check the --parent key and the app's collection factory for this model.")
         });
-    } catch (e) {
-        result = {
-            error: _instanceof$x(e, Error) ? e.message : String(e)
-        };
     }
     return result;
 }
-/**
- * Reads a resolvable `package.json`'s `version`.
- *
- * @param resolver - The `require` to load through.
- * @param specifier - The `package.json` specifier.
- * @returns The version string, or `undefined` when absent.
- */ function readPackageVersion(resolver, specifier) {
-    var contents = resolver(specifier);
-    return typeof contents.version === 'string' ? contents.version : undefined;
-}
 
 function _array_like_to_array$1a(arr, len) {
     if (len == null || len > arr.length) len = arr.length;
@@ -1919,6 +1753,32 @@ function _async_to_generator$1r(fn) {
         });
     };
 }
+function _define_property$$(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _object_spread$_(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$$(target, key, source[key]);
+        });
+    }
+    return target;
+}
 function _ts_generator$1r(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -2018,103 +1878,69 @@ function _ts_generator$1r(thisArg, body) {
         };
     }
 }
-function _type_of$6(obj) {
-    "@swc/helpers - typeof";
-    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
-}
 /**
- * Path (relative to the API base URL) of the direct-Firestore session endpoint served by
- * `@dereekb/firebase-server`'s `SessionApiController`.
+ * `CliError` code raised for each {@link FirestoreSessionErrorCode}.
  *
- * Duplicated here rather than imported so `dbx-cli` keeps no dependency on the server package —
- * the same arrangement `CALL_MODEL_API_PATH` uses.
- */ var FIRESTORE_SESSION_API_PATH = "/session/firestore";
+ * The mapping is exhaustive rather than defaulted so a new generic code is a compile error here
+ * instead of a silent `API_ERROR` in the operator's output.
+ */ var CLI_FIRESTORE_SESSION_ERROR_CODES = {
+    unauthorized: 'AUTH_UNAUTHORIZED',
+    forbidden: 'AUTH_FORBIDDEN',
+    not_found: 'NOT_FOUND',
+    unavailable: 'SERVER_ERROR',
+    invalid_response: 'API_ERROR',
+    invalid_config: 'INVALID_ARGUMENT'
+};
+/**
+ * Maps a generic session failure onto a {@link CliError}, re-attaching the CLI-flavored remediation
+ * an operator can act on (`<cli> auth login --env <env>` and friends).
+ *
+ * @param input - The generic failure.
+ * @returns The `CliError` to throw.
+ */ var cliFirestoreSessionErrorFactory = function cliFirestoreSessionErrorFactory(input) {
+    // the 401/403 text is CLI-specific — it names the command an operator runs to fix it, which the
+    // package-level wording deliberately cannot
+    var suggestion = input.code === 'unauthorized' || input.code === 'forbidden' ? 'The direct-Firestore session endpoint is admin-only and requires the `session.firestore` scope. Run `<cli> auth login` with that scope as an admin user.' : input.suggestion;
+    return new CliError(_object_spread$_({
+        message: input.message,
+        code: CLI_FIRESTORE_SESSION_ERROR_CODES[input.code]
+    }, suggestion == null ? {} : {
+        suggestion: suggestion
+    }));
+};
 /**
  * Fetches a direct-Firestore session from the API with the cached Bearer access token.
  *
- * The endpoint is admin-only and additionally gated on the `session.firestore` OIDC scope, so a 403
- * here usually means the logged-in user is not an admin or logged in without that scope.
+ * The thin CLI wrapper over `@dereekb/oauth-resource/firebase`'s `fetchFirestoreSession`: it binds
+ * the CLI's `tracedFetch` (so `--verbose` and `--timeout` apply) and the `CliError` factory.
  *
  * @param input - The API target, access token, and optional fetch override.
  * @returns The parsed {@link CliFirestoreSession}.
  * @throws {CliError} When the endpoint answers non-2xx or returns an unusable body.
  */ function fetchFirestoreSession(input) {
     return _async_to_generator$1r(function() {
-        var url, res, text, body, session;
         return _ts_generator$1r(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    url = "".concat(trimSlash(input.apiBaseUrl)).concat(FIRESTORE_SESSION_API_PATH);
-                    return [
-                        4,
-                        tracedFetch(input.fetcher, url, {
-                            method: 'GET',
-                            headers: {
-                                Accept: 'application/json',
-                                Authorization: "Bearer ".concat(input.accessToken)
-                            }
-                        })
-                    ];
-                case 1:
-                    res = _state.sent();
-                    return [
-                        4,
-                        res.text()
-                    ];
-                case 2:
-                    text = _state.sent();
-                    if (text.length > 0) {
-                        try {
-                            body = JSON.parse(text);
-                        } catch (unused) {
-                            body = text;
-                        }
-                    }
-                    if (!res.ok) {
-                        throw new CliError({
-                            message: "firestore session request failed: ".concat(extractMessage(body, text, res)),
-                            code: codeForStatus(res.status),
-                            suggestion: res.status === 401 || res.status === 403 ? 'The direct-Firestore session endpoint is admin-only and requires the `session.firestore` scope. Run `<cli> auth login` with that scope as an admin user.' : 'Verify the API exposes `/session/firestore` (the firebase-server session module must be registered and `/api/session` added to the OIDC `protectedPaths`).'
-                        });
-                    }
-                    session = body;
-                    if (!(session === null || session === void 0 ? void 0 : session.customToken)) {
-                        throw new CliError({
-                            message: 'firestore session response did not include a customToken.',
-                            code: 'API_ERROR',
-                            suggestion: 'Verify the API is running a `@dereekb/firebase-server` version that serves `/session/firestore`.'
-                        });
-                    }
-                    return [
-                        2,
-                        session
-                    ];
-            }
+            return [
+                2,
+                fetchFirestoreSession$1({
+                    apiBaseUrl: input.apiBaseUrl,
+                    accessToken: input.accessToken,
+                    fetcher: cliFirestoreSessionFetcher(input.fetcher),
+                    errorFactory: cliFirestoreSessionErrorFactory
+                })
+            ];
         });
     })();
 }
-function extractMessage(body, fallback, res) {
-    var bodyMessage = (typeof body === "undefined" ? "undefined" : _type_of$6(body)) === 'object' && body && 'message' in body ? body.message : undefined;
-    var messageString = typeof bodyMessage === 'string' ? bodyMessage : undefined;
-    return messageString !== null && messageString !== void 0 ? messageString : fallback || "".concat(res.status, " ").concat(res.statusText);
-}
-function codeForStatus(status) {
-    var result;
-    if (status === 401) {
-        result = 'AUTH_UNAUTHORIZED';
-    } else if (status === 403) {
-        result = 'AUTH_FORBIDDEN';
-    } else if (status === 404) {
-        result = 'NOT_FOUND';
-    } else if (status >= 500) {
-        result = 'SERVER_ERROR';
-    } else {
-        result = 'API_ERROR';
-    }
-    return result;
-}
-function trimSlash(url) {
-    return url.endsWith('/') ? url.slice(0, -1) : url;
+/**
+ * Binds the CLI's verbose-trace + `--timeout` fetch behavior onto the supplied (or global) fetch.
+ *
+ * @param fetcher - The underlying fetch impl, when one was injected.
+ * @returns A `fetch`-shaped function carrying the CLI's tracing.
+ */ function cliFirestoreSessionFetcher(fetcher) {
+    return function(input, init) {
+        return tracedFetch(fetcher, input, init);
+    };
 }
 
 function _define_property$_(obj, key, value) {
@@ -2327,8 +2153,8 @@ function nonEmpty(value) {
 }
 /**
  * Default host used for Firebase emulator connections when a {@link CliFirebaseEmulatorsConfig}
- * omits one.
- */ var DEFAULT_CLI_FIREBASE_EMULATOR_HOST = 'localhost';
+ * omits one. See {@link DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST}.
+ */ var DEFAULT_CLI_FIREBASE_EMULATOR_HOST = DEFAULT_FIREBASE_CLIENT_EMULATOR_HOST;
 /**
  * Returns true when the env carries the minimum Firebase client config needed to open a direct
  * Firestore session.
@@ -2336,20 +2162,12 @@ function nonEmpty(value) {
  * Deliberately separate from {@link isCliEnvConfigComplete}: the Firebase config is optional, and
  * folding it into the general completeness check would break every CLI that only uses the model API.
  *
- * @param firebase - The env's Firebase client config, if any.
- * @returns `true` when `apiKey`, `projectId`, and `appId` are all present and non-empty.
- */ function isCliFirebaseConfigComplete(firebase) {
-    return Boolean((firebase === null || firebase === void 0 ? void 0 : firebase.apiKey) && (firebase === null || firebase === void 0 ? void 0 : firebase.projectId) && (firebase === null || firebase === void 0 ? void 0 : firebase.appId));
-}
+ * See {@link isFirebaseClientConfigComplete}.
+ */ var isCliFirebaseConfigComplete = isFirebaseClientConfigComplete;
 /**
- * Returns true when the env's emulator config is present and active.
- *
- * @param firebase - The env's Firebase client config, if any.
- * @returns `true` when emulators are configured and not explicitly disabled.
- */ function cliFirebaseEmulatorsInUse(firebase) {
-    var emulators = firebase === null || firebase === void 0 ? void 0 : firebase.emulators;
-    return Boolean(emulators && emulators.useEmulators !== false && (emulators.authPort != null || emulators.firestorePort != null));
-}
+ * Returns true when the env's emulator config is present and active. See
+ * {@link firebaseClientEmulatorsInUse}.
+ */ var cliFirebaseEmulatorsInUse = firebaseClientEmulatorsInUse;
 /**
  * Resolves the active env name from a flag, env var, or persisted default.
  *
@@ -2473,65 +2291,6 @@ function parsePort(value) {
     return result;
 }
 
-/**
- * Hard ceiling on how long a minted direct-Firestore session may be reused, regardless of what the
- * API reported in `expiresAt`.
- *
- * One hour, because that is the Firebase ceiling the credentials themselves sit under: a custom
- * token is exchangeable for one hour, and the ID token it mints lives one hour. Holding a session
- * past that buys nothing — the sign-in would fail — and re-minting is one HTTP round-trip.
- */ var CLI_FIRESTORE_SESSION_MAX_CACHE_MS = 60 * 60 * 1000;
-/**
- * Default skew/latency buffer applied when deciding whether a cached session is still usable.
- */ var CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS = 60000;
-/**
- * Creates a per-env direct-Firestore session cache store backed by a single JSON file.
- *
- * Entries are written with mode 0o600 — they hold a Firebase custom token, which is a bearer
- * credential for the user it was minted for.
- *
- * @param input - The cache store inputs.
- * @param input.firestoreSessionCachePath - Absolute path to the JSON file backing the cache.
- * @returns A {@link CliFirestoreSessionCacheStore} keyed by env name.
- * @__NO_SIDE_EFFECTS__
- */ function createCliFirestoreSessionCacheStore(input) {
-    return createMemoizedJsonFileAsyncKeyedValueCache({
-        filePath: input.firestoreSessionCachePath
-    });
-}
-/**
- * Resolves the epoch-millis instant at which a cached session stops being usable.
- *
- * The effective expiry is the EARLIER of the API-reported `expiresAt` and
- * {@link CLI_FIRESTORE_SESSION_MAX_CACHE_MS} past the write. Taking the earlier of the two means a
- * server that reports an over-long (or unparsable) window still cannot push a session past the
- * Firebase credential ceiling.
- *
- * @param entry - The cached entry.
- * @returns The effective expiry in unix epoch milliseconds.
- *
- * @__NO_SIDE_EFFECTS__
- */ function cliFirestoreSessionEntryExpiresAt(entry) {
-    var ceiling = entry.cachedAt + CLI_FIRESTORE_SESSION_MAX_CACHE_MS;
-    var reported = Date.parse(entry.session.expiresAt);
-    return Number.isFinite(reported) ? Math.min(reported, ceiling) : ceiling;
-}
-/**
- * Returns true when the cached session is at or near its effective expiry.
- *
- * @param entry - The cached entry (`null`/`undefined` is treated as expired).
- * @param nowMs - The current time in unix epoch milliseconds. Defaults to `Date.now()`.
- * @param bufferMs - Skew/latency buffer; the entry is treated as expired this far ahead of its effective expiry.
- * @returns `true` when the entry is unusable, otherwise `false`.
- */ function isCliFirestoreSessionExpired(entry) {
-    var nowMs = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : Date.now(), bufferMs = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS;
-    return entry == null || expirationDetails({
-        expiresFromDate: cliFirestoreSessionEntryExpiresAt(entry),
-        expiresIn: -bufferMs,
-        now: new Date(nowMs)
-    }).hasExpired();
-}
-
 function asyncGeneratorStep$1q(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -2569,12 +2328,6 @@ function _define_property$Z(obj, key, value) {
     } else obj[key] = value;
     return obj;
 }
-function _instanceof$w(left, right) {
-    "@swc/helpers - instanceof";
-    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
-        return !!right[Symbol.hasInstance](left);
-    } else return left instanceof right;
-}
 function _object_spread$Y(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
@@ -2707,40 +2460,15 @@ function _ts_generator$1q(thisArg, body) {
         };
     }
 }
-/**
- * The Firebase app name a direct-Firestore session registers for a CLI + env pair.
- *
- * Deriving the name rather than tracking apps in a side registry is what makes ONE app per CLI + env
- * per process a property of the code instead of a convention: {@link createCliFirestoreSessionContext}
- * looks this name up in `getApps()` before initializing, so repeated session opens in one process —
- * a doctor probe alongside a command's own session, an action that re-resolves the accessor — all
- * share a single app, and {@link closeAllCliFirebaseApps} finds it again from the name alone.
- *
- * @param input - The CLI name and env name the session targets.
- * @returns The Firebase app name for that pair.
- * @__NO_SIDE_EFFECTS__
- */ function cliFirebaseAppName(input) {
-    return "".concat(input.cliName, "-").concat(input.envName);
-}
 /**
  * Opens a direct Firestore connection as the authenticated CLI user.
  *
- * Steps, in a strict order:
- *
- * 0. When a `sessionCache` is supplied, reuse the env's cached credential envelope if it is still
- *    live. Sessions are cached for up to an hour (see `CLI_FIRESTORE_SESSION_MAX_CACHE_MS`), which is
- *    the ceiling the Firebase credentials themselves sit under. A hit skips step 1 only — the
- *    Firebase app is per-process, so the sign-in in step 5 always runs.
- * 1. `GET <apiBaseUrl>/session/firestore` for a custom token + App Check attestation.
- * 2. `initializeApp` with the env's Firebase client config.
- * 3. `initializeAppCheck` with a `CustomProvider` handing back the server-minted token. **This must
- *    happen before any other Firebase call** — `dbx-firebase`'s provider documents the same
- *    constraint: "App Check must be initialized before any Firebase request goes out, otherwise
- *    requests are sent without an App Check token and are rejected in production." Skipped when the
- *    env targets emulators (which do not verify attestations) or when the API minted no token.
- * 4. `getAuth` / `getFirestore`, connecting each to its emulator when configured.
- * 5. `signInWithCustomToken`. The user's stored custom claims land at the top level of the exchanged
- *    ID token, so `request.auth.token.<claim>` reads in security rules behave exactly as in the app.
+ * A thin wrapper over `openFirebaseUserSession`: it validates the env's Firebase client config with
+ * the CLI's own env-var-naming remediation, then delegates. The strict step ORDER (mint → fresh app →
+ * App Check FIRST → emulator wiring → sign-in) and its reasoning live with the implementation.
+ *
+ * The session's Firebase app is named `<cliName>::<envName>::<uid>`, so
+ * {@link closeAllCliFirebaseApps} finds every app this CLI opened from the name alone.
  *
  * There is deliberately NO fallback to the HTTP model API — a failure here throws so the operator
  * sees it. `createFirestoreSessionDoctorCheck` is the diagnostic surface for why.
@@ -2750,7 +2478,7 @@ function _ts_generator$1q(thisArg, body) {
  * @throws {CliError} When the env lacks Firebase client config, or any step of the handshake fails.
  */ function createCliFirestoreSessionContext(input) {
     return _async_to_generator$1q(function() {
-        var _ref, _getApps_find, _firebase_emulators, _firebase_emulators1, _firebase_emulators2, cliName, envName, env, accessToken, fetcher, sessionCache, _input_refreshSession, refreshSession, firebase, cached, _tmp, liveCached, fromCache, session, _tmp1, appName, app, useEmulators, appCheckToken, expireTimeMillis, emulatorHost, auth, firestore, e;
+        var cliName, envName, env, accessToken, fetcher, sessionCache, _input_refreshSession, refreshSession, firebase, session;
         return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -2763,168 +2491,30 @@ function _ts_generator$1q(thisArg, body) {
                             suggestion: "Set `firebase.apiKey`, `firebase.projectId`, and `firebase.appId` on the env (or via ".concat(cliName.replaceAll('-', '_').toUpperCase(), "_FIREBASE_* environment variables). Copy them from the app's Firebase web app config.")
                         });
                     }
-                    if (!(sessionCache && !refreshSession)) return [
-                        3,
-                        2
-                    ];
-                    return [
-                        4,
-                        sessionCache.get(envName)
-                    ];
-                case 1:
-                    _tmp = _state.sent();
-                    return [
-                        3,
-                        3
-                    ];
-                case 2:
-                    _tmp = undefined;
-                    _state.label = 3;
-                case 3:
-                    cached = _tmp;
-                    liveCached = isCliFirestoreSessionExpired(cached) ? undefined : cached;
-                    fromCache = liveCached != null;
-                    if (!((_ref = liveCached === null || liveCached === void 0 ? void 0 : liveCached.session) !== null && _ref !== void 0)) return [
-                        3,
-                        4
-                    ];
-                    _tmp1 = _ref;
-                    return [
-                        3,
-                        6
-                    ];
-                case 4:
                     return [
                         4,
-                        fetchFirestoreSession({
+                        openFirebaseUserSession({
+                            namespace: cliName,
+                            scope: envName,
+                            firebase: firebase,
                             apiBaseUrl: env.apiBaseUrl,
                             accessToken: accessToken,
-                            fetcher: fetcher
+                            fetcher: cliFirestoreSessionFetcher(fetcher),
+                            errorFactory: cliFirestoreSessionErrorFactory,
+                            // the CLI's cache is keyed by ENV name, not uid: one CLI process serves one user, and the env is
+                            // what its on-disk `~/.<cli>/.firestore-sessions.json` has always been keyed by
+                            credentialsCache: sessionCache,
+                            cacheKey: envName,
+                            refreshCredentials: refreshSession
                         })
                     ];
-                case 5:
-                    _tmp1 = _state.sent();
-                    _state.label = 6;
-                case 6:
-                    session = _tmp1;
-                    if (!(!fromCache && sessionCache)) return [
-                        3,
-                        8
-                    ];
-                    return [
-                        4,
-                        sessionCache.set(envName, {
-                            session: session,
-                            cachedAt: Date.now(),
-                            uid: session.uid
-                        })
-                    ];
-                case 7:
-                    _state.sent();
-                    _state.label = 8;
-                case 8:
-                    appName = cliFirebaseAppName({
-                        cliName: cliName,
-                        envName: envName
-                    });
-                    app = (_getApps_find = getApps().find(function(x) {
-                        return x.name === appName;
-                    })) !== null && _getApps_find !== void 0 ? _getApps_find : initializeApp({
-                        apiKey: firebase.apiKey,
-                        authDomain: firebase.authDomain,
-                        projectId: firebase.projectId,
-                        appId: firebase.appId
-                    }, appName);
-                    useEmulators = cliFirebaseEmulatorsInUse(firebase);
-                    // App Check must be registered on the app before any Firebase request goes out. Mirrors
-                    // `createDbxFirebaseAppCheck`, which likewise disables App Check whenever emulators are in use.
-                    if (session.appCheckToken && !useEmulators) {
-                        appCheckToken = session.appCheckToken;
-                        expireTimeMillis = expireTimeMillisFromSession(session);
-                        initializeAppCheck(app, {
-                            provider: new CustomProvider({
-                                getToken: function getToken() {
-                                    return _async_to_generator$1q(function() {
-                                        return _ts_generator$1q(this, function(_state) {
-                                            return [
-                                                2,
-                                                {
-                                                    token: appCheckToken,
-                                                    expireTimeMillis: expireTimeMillis
-                                                }
-                                            ];
-                                        });
-                                    })();
-                                }
-                            }),
-                            // the token is minted per-session by the API; there is no local attestation to refresh against
-                            isTokenAutoRefreshEnabled: false
-                        });
-                    }
-                    emulatorHost = ((_firebase_emulators = firebase.emulators) === null || _firebase_emulators === void 0 ? void 0 : _firebase_emulators.host) || DEFAULT_CLI_FIREBASE_EMULATOR_HOST;
-                    auth = getAuth(app);
-                    if (useEmulators && ((_firebase_emulators1 = firebase.emulators) === null || _firebase_emulators1 === void 0 ? void 0 : _firebase_emulators1.authPort) != null) {
-                        connectAuthEmulator(auth, "http://".concat(emulatorHost, ":").concat(firebase.emulators.authPort), {
-                            disableWarnings: true
-                        });
-                    }
-                    firestore = getFirestore(app);
-                    if (useEmulators && ((_firebase_emulators2 = firebase.emulators) === null || _firebase_emulators2 === void 0 ? void 0 : _firebase_emulators2.firestorePort) != null) {
-                        connectFirestoreEmulator(firestore, emulatorHost, firebase.emulators.firestorePort);
-                    }
-                    _state.label = 9;
-                case 9:
-                    _state.trys.push([
-                        9,
-                        11,
-                        ,
-                        14
-                    ]);
-                    return [
-                        4,
-                        signInWithCustomToken(auth, session.customToken)
-                    ];
-                case 10:
-                    _state.sent();
-                    return [
-                        3,
-                        14
-                    ];
-                case 11:
-                    e = _state.sent();
-                    if (!(fromCache && sessionCache)) return [
-                        3,
-                        13
-                    ];
-                    return [
-                        4,
-                        sessionCache.remove(envName)
-                    ];
-                case 12:
-                    _state.sent();
-                    return [
-                        2,
-                        createCliFirestoreSessionContext(_object_spread_props$E(_object_spread$Y({}, input), {
-                            refreshSession: true
-                        }))
-                    ];
-                case 13:
-                    throw new CliError({
-                        message: "Failed to sign in with the minted custom token: ".concat(_instanceof$w(e, Error) ? e.message : String(e)),
-                        code: 'AUTH_UNAUTHORIZED',
-                        suggestion: 'Verify the env `firebase.projectId`/`firebase.apiKey` match the project the API mints tokens for.'
-                    });
-                case 14:
+                case 1:
+                    session = _state.sent();
                     return [
                         2,
-                        {
-                            session: session,
-                            fromCache: fromCache,
-                            app: app,
-                            auth: auth,
-                            firestore: firestore,
-                            firestoreContext: clientFirebaseFirestoreContextFactory(firestore)
-                        }
+                        _object_spread_props$E(_object_spread$Y({}, session), {
+                            session: session.credentials
+                        })
                     ];
             }
         });
@@ -2935,15 +2525,7 @@ function _ts_generator$1q(thisArg, body) {
  *
  * Required for the CLI to EXIT. A signed-in `Auth` and a live `Firestore` both hold open handles
  * that keep the Node event loop alive indefinitely, so without this a command prints its result and
- * then hangs forever — the process never returns to the shell. Nothing in the CLI is long-lived
- * enough to want that: a session is opened for one invocation and is dead weight afterwards.
- *
- * `deleteApp` is the single call that covers it — it disposes every registered component, which for
- * Firestore runs the same shutdown `terminate()` does, and for Auth stops the token-refresh timer.
- *
- * Deliberately tolerant: teardown runs in a `finally` after the command has already produced its
- * output, so a failure here must not change the exit code or mask the real result. A session that
- * was never opened is a no-op.
+ * then hangs forever — the process never returns to the shell.
  *
  * @param session - The session context to close.
  */ function closeCliFirestoreSessionContext(session) {
@@ -2953,7 +2535,7 @@ function _ts_generator$1q(thisArg, body) {
                 case 0:
                     return [
                         4,
-                        closeCliFirebaseApp(session.app)
+                        closeFirebaseUserSession(session)
                     ];
                 case 1:
                     _state.sent();
@@ -2964,85 +2546,32 @@ function _ts_generator$1q(thisArg, body) {
         });
     })();
 }
-/**
- * Deletes one Firebase app, swallowing any failure.
- *
- * @param app - The app to delete.
- */ function closeCliFirebaseApp(app) {
-    return _async_to_generator$1q(function() {
-        return _ts_generator$1q(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    _state.trys.push([
-                        0,
-                        2,
-                        ,
-                        3
-                    ]);
-                    return [
-                        4,
-                        deleteApp(app)
-                    ];
-                case 1:
-                    _state.sent();
-                    return [
-                        3,
-                        3
-                    ];
-                case 2:
-                    _state.sent();
-                    return [
-                        3,
-                        3
-                    ];
-                case 3:
-                    return [
-                        2
-                    ];
-            }
-        });
-    })();
-}
 /**
  * Deletes every still-live Firebase app this CLI opened, whether or not a session was handed back.
  *
- * The CLI's last line of defence against a hang. `closeCliFirestoreSessionContext` covers the normal
- * path, but it needs a session to be handed to it, and three cases never produce one:
+ * The CLI's last line of defence against a hang. {@link closeCliFirestoreSessionContext} covers the
+ * normal path, but it needs a session to be handed to it, and three cases never produce one:
  *
- * - a handshake that fails AFTER `initializeApp` — a rejected custom token, a failed App Check
- *   registration — throws, so the caller that catches it has an initialized app and no session;
+ * - a handshake that fails AFTER `initializeApp` — a failed App Check registration, a broken emulator
+ *   connection — throws, so the caller that catches it has an initialized app and no session;
  * - a caller that opens its own session outside the context memo (the doctor probe) owns its own
  *   teardown, and forgetting it hangs the process;
  * - a {@link CliContext} orphaned mid-invocation carries the only reference to its session memo.
  *
- * Each leaves an app whose `Firestore` and signed-in `Auth` hold the Node event loop open forever.
- * `getApps()` already tracks every live app and `deleteApp` removes it from that list, so the app
- * names {@link cliFirebaseAppName} derives are enough to find them again — no side registry to keep
- * in sync, and idempotent by construction.
- *
- * Tolerant of failures for the same reason {@link closeCliFirestoreSessionContext} is: it runs after
- * the result is already on stdout.
- *
  * @param input - The function inputs.
  * @param input.cliName - The CLI whose apps should be closed. Apps belonging to other Firebase
  *   consumers in the same process are left alone.
  * @returns Resolves once every matching app has been deleted.
  */ function closeAllCliFirebaseApps(input) {
     return _async_to_generator$1q(function() {
-        var prefix, apps;
         return _ts_generator$1q(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    // every env this process opened a session for, which is normally exactly one
-                    prefix = "".concat(input.cliName, "-");
-                    apps = getApps().filter(function(x) {
-                        return x.name.startsWith(prefix);
-                    });
                     return [
                         4,
-                        Promise.all(apps.map(function(app) {
-                            return closeCliFirebaseApp(app);
-                        }))
+                        closeFirebaseUserSessionApps({
+                            namespace: input.cliName
+                        })
                     ];
                 case 1:
                     _state.sent();
@@ -3053,16 +2582,6 @@ function _ts_generator$1q(thisArg, body) {
         });
     })();
 }
-/**
- * Resolves the App Check token's expiry from the session envelope, falling back to a short window
- * when the API returned an unparsable `expiresAt`.
- *
- * @param session - The session envelope returned by the API.
- * @returns The epoch-millis expiry to advertise to the App Check `CustomProvider`.
- */ function expireTimeMillisFromSession(session) {
-    var parsed = Date.parse(session.expiresAt);
-    return Number.isFinite(parsed) ? parsed : Date.now() + 30 * 60 * 1000;
-}
 
 /**
  * Creates a typed module-level slot.
@@ -7904,6 +7423,43 @@ function resolveCliEnvOrThrow(input) {
     };
 }
 
+/**
+ * Hard ceiling on how long a minted direct-Firestore session may be reused, regardless of what the
+ * API reported in `expiresAt`. See {@link FIRESTORE_SESSION_MAX_CACHE_MS}.
+ */ var CLI_FIRESTORE_SESSION_MAX_CACHE_MS = FIRESTORE_SESSION_MAX_CACHE_MS;
+/**
+ * Default skew/latency buffer applied when deciding whether a cached session is still usable. See
+ * {@link FIRESTORE_SESSION_EXPIRY_BUFFER_MS}.
+ */ var CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS = FIRESTORE_SESSION_EXPIRY_BUFFER_MS;
+/**
+ * Creates a per-env direct-Firestore session cache store backed by a single JSON file.
+ *
+ * The file-backed half of the session cache stays HERE rather than moving to
+ * `@dereekb/oauth-resource/firebase`: it depends on `@dereekb/nestjs`, and a Nest peer has no business
+ * in a package whose whole point is a clean install graph. Only the expiry policy and the
+ * {@link FirestoreSessionCredentialsCache} port are shared.
+ *
+ * Entries are written with mode 0o600 — they hold a Firebase custom token, which is a bearer
+ * credential for the user it was minted for.
+ *
+ * @param input - The cache store inputs.
+ * @param input.firestoreSessionCachePath - Absolute path to the JSON file backing the cache.
+ * @returns A {@link CliFirestoreSessionCacheStore} keyed by env name.
+ * @__NO_SIDE_EFFECTS__
+ */ function createCliFirestoreSessionCacheStore(input) {
+    return createMemoizedJsonFileAsyncKeyedValueCache({
+        filePath: input.firestoreSessionCachePath
+    });
+}
+/**
+ * Resolves the epoch-millis instant at which a cached session stops being usable. See
+ * {@link firestoreSessionEntryExpiresAt}.
+ */ var cliFirestoreSessionEntryExpiresAt = firestoreSessionEntryExpiresAt;
+/**
+ * Returns true when the cached session is at or near its effective expiry. See
+ * {@link isFirestoreSessionExpired}.
+ */ var isCliFirestoreSessionExpired = isFirestoreSessionExpired;
+
 /**
  * Creates a per-env token cache store backed by a single JSON file.
  *
@@ -69807,4 +69363,4 @@ function printPaginatedOutput(input) {
     })();
 }
 
-export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILD_DRIFT_DOCTOR_CHECK_NAME, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, CLI_DATA_CACHE_CYCLE_ERROR_CODE, CLI_DATA_CACHE_FINGERPRINT_LENGTH, CLI_DATA_CACHE_GLOBAL_OPTION_NAMES, CLI_DATA_CACHE_INDEX_FILE_NAME, CLI_DATA_CACHE_SCHEMA_VERSION, CLI_DATA_CACHE_UNSUPPORTED_VALUE_ERROR_CODE, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CLI_FIRESTORE_QUERY_DATASET_PREFIX, CLI_FIRESTORE_QUERY_DATASET_VERSION, CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS, CLI_FIRESTORE_SESSION_MAX_CACHE_MS, CLI_FRAMEWORK_PACKAGE_PREFIX, CLI_READ_VIA_EPILOGUE, CLI_READ_VIA_VALUES, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_CODEC, DEFAULT_CLI_DATA_CACHE_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_MAX_AGE_HOURS, DEFAULT_CLI_DATA_CACHE_OPTIONS, DEFAULT_CLI_FIREBASE_EMULATOR_HOST, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_READ_VIA, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FIRESTORE_GET_COMMAND_NAME, DEFAULT_FIRESTORE_QUERIES_COMMAND_NAME, DEFAULT_FIRESTORE_QUERY_COMMAND_NAME, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DISABLED_CLI_DATA_CACHE_OPTIONS, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FIRESTORE_COLLECTION_UNRESOLVABLE_CODE, FIRESTORE_QUERY_PARENT_REQUIRED_CODE, FIRESTORE_QUERY_UNAVAILABLE_CODE, FIRESTORE_SDK_IDENTITY_STAGE, FIRESTORE_SDK_INSTANCE_MISMATCH_CODE, FIRESTORE_SESSION_API_PATH, FIRESTORE_SESSION_DOCTOR_CHECK_NAME, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, LOOPBACK_REDIRECT_HOSTNAMES, LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE, LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_IS_SERVER_ONLY_CODE, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, STDIN_NOT_PIPED_ERROR_CODE, SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, appendCliErrorMapper, applyEnvVarOverrides, assertCliFirestoreQueryCanRun, assertCliFirestoreQueryParentKey, assertCliModelIsNotServerOnly, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildFirestoreGetCommand, buildFirestoreQueriesCommand, buildFirestoreQueryCommand, buildFirestoreSessionDoctorReadRouting, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, canonicalCliCacheJson, checkCliDataCacheArgv, clearDownstreamCatalogCache, cliBuildDriftDescription, cliCacheFingerprint, cliDataCacheKey, cliDataCacheMeta, cliDataCacheOptions, cliDataCachePathSegment, cliFirebaseAppName, cliFirebaseEmulatorsInUse, cliFirestoreAccessorFactory, cliFirestoreBinding, cliFirestoreCollectionForQuery, cliFirestoreErrorMapper, cliFirestoreQueryConstraints, cliFirestoreQueryMode, cliFirestoreQueryModeForRules, cliFirestoreSdkIdentitySuggestion, cliFirestoreSessionEntryExpiresAt, cliFirestoreWiringError, cliLifecycleRunner, cliReadResultMeta, closeAllCliFirebaseApps, closeCliFirestoreSessionContext, coerceCliReadVia, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliDataCacheOptions, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCacheCommand, createCallModelCommand, createCli, createCliBuildDriftDoctorCheck, createCliContext, createCliDataCache, createCliFirestoreModels, createCliFirestoreQueryRegistry, createCliFirestoreSessionCacheStore, createCliFirestoreSessionContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createFirestoreSessionDoctorCheck, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, describeCliFirestoreQueryMode, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchFirestoreSession, fetchSessionInfo, fetchUserInfo, filterCliFirestoreQueries, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, formatGeneratedTs, fromCliCacheJson, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverFirestore, getModelOverHttp, getMultipleModelsOverFirestore, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, indentLines$1 as indentLines, inspectCliBuildDrift, inspectCliFirestoreSdkIdentity, isCliEnvConfigComplete, isCliFirebaseConfigComplete, isCliFirestoreQueryInvocable, isCliFirestoreSessionExpired, isCliVerbose, isCoreTopic, isEntryExpired, isExportedFromPackage, isStdinPositionalSentinel, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadOrBuildCliCachedData, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeCliFirebaseConfig, mergeOutputConfig, normalizeCliCacheFilter, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, openUrlInBrowser, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parseLoopbackRedirectUri, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readCliArtifactPackage, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderCliFirestoreQueryEntry, renderCliFirestoreQueryList, renderDecodedKey, renderGroupedImportLines, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, renderTable, requireCliContext, requireCliFirestoreContext, requireCliFirestoreModels, requireCliFirestoreSession, resolveActiveEnvName, resolveCliDataCacheOptions, resolveCliEnv, resolveCliEnvOrThrow, resolveCliFirestoreQueryArgs, resolveCliFirestoreQueryEntry, resolveCliModel, resolveCliReadSource, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolveOxfmtConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCliFirestoreQuery, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliRawArgv, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, startLoopbackRedirectCapture, stripUrlQueryAndHash, toActionEntryInfo, toCliCacheJson, toFilterEntryInfo, toFormFieldInfo, tracedFetch, truncate, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler, writeGeneratedTsFile };
+export { ACTIONS_SCAN_CONFIG_FILENAME, ACTION_ENTRY_ROLES, ACTION_ROLE_ORDER, ActionDirectiveEntry, ActionEntry, ActionInputEntry, ActionManifest, ActionOutputEntry, ActionStateEntry, ActionStoreEntry, ActionStoreMethodEntry, ActionStoreObservableEntry, ActionsScanConfig, ActionsScanSection, BUILD_DRIFT_DOCTOR_CHECK_NAME, BUILTIN_AUTH_CLAIMS, BUILTIN_AUTH_ROLES, BUILTIN_AUTH_SCOPES, CALL_MODEL_API_PATH, CALL_PASSTHROUGH_COMMAND, CLI_CLIENT_FIRESTORE_DRIVER_IDENTIFIER, CLI_DATA_CACHE_CYCLE_ERROR_CODE, CLI_DATA_CACHE_FINGERPRINT_LENGTH, CLI_DATA_CACHE_GLOBAL_OPTION_NAMES, CLI_DATA_CACHE_INDEX_FILE_NAME, CLI_DATA_CACHE_SCHEMA_VERSION, CLI_DATA_CACHE_UNSUPPORTED_VALUE_ERROR_CODE, CLI_EXIT_CODE_AUTH, CLI_EXIT_CODE_HANDLER, CLI_FIRESTORE_QUERY_DATASET_PREFIX, CLI_FIRESTORE_QUERY_DATASET_VERSION, CLI_FIRESTORE_SESSION_EXPIRY_BUFFER_MS, CLI_FIRESTORE_SESSION_MAX_CACHE_MS, CLI_FRAMEWORK_PACKAGE_PREFIX, CLI_READ_VIA_EPILOGUE, CLI_READ_VIA_VALUES, CORE_TOPICS, CORE_TOPICS_SET, CSS_UTILITIES_SCAN_CONFIG_FILENAME, CSS_UTILITY_ROLES, CSS_UTILITY_SCOPES, CliError, CssUtilitiesScanConfig, CssUtilitiesScanSection, CssUtilityDeclaration, CssUtilityEntry, CssUtilityManifest, DBX_ACTION_STATE_VALUES, DBX_DOCS_UI_EXAMPLES_SCAN_CONFIG_FILENAME, DBX_DOCS_UI_EXAMPLE_USE_KINDS, DEFAULT_ACTIONS_SCAN_OUT_PATH, DEFAULT_ACTION_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_CODEC, DEFAULT_CLI_DATA_CACHE_COMMAND_NAME, DEFAULT_CLI_DATA_CACHE_MAX_AGE_HOURS, DEFAULT_CLI_DATA_CACHE_OPTIONS, DEFAULT_CLI_FIREBASE_EMULATOR_HOST, DEFAULT_CLI_HTTP_TIMEOUT_MS, DEFAULT_CLI_OIDC_SCOPES, DEFAULT_CLI_READ_VIA, DEFAULT_CLI_REDIRECT_URI, DEFAULT_CLI_SECRET_PATTERNS, DEFAULT_CSS_UTILITIES_SCAN_OUT_PATH, DEFAULT_DBX_DOCS_UI_EXAMPLES_SCAN_OUT_PATH, DEFAULT_FILTERS_SCAN_OUT_PATH, DEFAULT_FIRESTORE_GET_COMMAND_NAME, DEFAULT_FIRESTORE_QUERIES_COMMAND_NAME, DEFAULT_FIRESTORE_QUERY_COMMAND_NAME, DEFAULT_FORGE_FIELDS_SCAN_OUT_PATH, DEFAULT_MANIFEST_HELP_DATA_FORMAT, DEFAULT_MANIFEST_HELP_MODE, DEFAULT_MANIFEST_MODEL_COMMAND_NAME, DEFAULT_MODEL_DECODE_COMMAND_NAME, DEFAULT_MODEL_INFO_COMMAND_NAME, DEFAULT_MODEL_SNAPSHOT_FIELDS_SCAN_OUT_PATH, DEFAULT_PIPES_SCAN_OUT_PATH, DEFAULT_SCAN_OUT_PATH, DEFAULT_SPECIFIER_KEY, DEFAULT_UI_COMPONENTS_SCAN_OUT_PATH, DEFAULT_UTILS_SCAN_OUT_PATH, DISABLED_CLI_DATA_CACHE_OPTIONS, DOWNSTREAM_CLUSTERS, DUMP_MERGE_MODES, DUMP_OUTPUT_MODES, DbxDocsUiExampleEntry, DbxDocsUiExampleManifest, DbxDocsUiExampleUseEntry, DbxDocsUiExamplesScanConfig, DbxDocsUiExamplesScanSection, DbxMcpConfig, EMPTY_ACTION_REGISTRY, EMPTY_AUTH_REGISTRY, EMPTY_CSS_UTILITY_REGISTRY, EMPTY_DBX_DOCS_UI_EXAMPLES_REGISTRY, EMPTY_FILTER_REGISTRY, EMPTY_FORGE_FIELD_REGISTRY, EMPTY_MODEL_SNAPSHOT_FIELD_REGISTRY, EMPTY_PIPE_REGISTRY, EMPTY_SEMANTIC_TYPE_REGISTRY, EMPTY_TOKEN_REGISTRY, EMPTY_UI_COMPONENT_REGISTRY, EMPTY_UTIL_REGISTRY, ExtractedDbxDocsUiExampleEntrySchema, ExtractedEntrySchema, ExtractedForgeFieldEntrySchema, ExtractedUiEntrySchema, FILTERS_SCAN_CONFIG_FILENAME, FILTER_KINDS, FILTER_KIND_ORDER, FIREBASE_MODELS, FIREBASE_MODEL_GROUPS, FIRESTORE_COLLECTION_UNRESOLVABLE_CODE, FIRESTORE_QUERY_PARENT_REQUIRED_CODE, FIRESTORE_QUERY_UNAVAILABLE_CODE, FIRESTORE_SDK_IDENTITY_STAGE, FIRESTORE_SDK_INSTANCE_MISMATCH_CODE, FIRESTORE_SESSION_DOCTOR_CHECK_NAME, FORGE_FIELDS_SCAN_CONFIG_FILENAME, FORGE_FIELD_ARRAY_OUTPUTS, FORGE_FIELD_COMPOSITE_SUFFIXES, FORGE_FIELD_TIERS, FORGE_FIELD_WRAPPER_PATTERNS, FORM_FIELDS, FORM_TIER_ORDER, FilterDirectiveEntry, FilterEntry, FilterInputEntry, FilterManifest, FilterPatternEntry, FiltersScanConfig, FiltersScanSection, ForgeFieldEntry, ForgeFieldManifest, ForgeFieldPropertyEntry, ForgeFieldsScanConfig, ForgeFieldsScanSection, GET_COMMAND, GET_MANY_COMMAND, LOOPBACK_REDIRECT_HOSTNAMES, LOOPBACK_REDIRECT_LISTEN_FAILED_ERROR_CODE, LOOPBACK_REDIRECT_TIMEOUT_ERROR_CODE, MAX_MODEL_ACCESS_MULTI_READ_KEYS, MCP_CALL_TYPE_ABBREVIATIONS, MCP_MANIFEST_VERSION, MCP_TOOL_NAME_MAX_LENGTH, MCP_TOOL_NAME_WARN_LENGTH, MODEL_ARCHETYPES, MODEL_ARCHETYPE_ADDON_SLUGS, MODEL_ARCHETYPE_SYNC_MODES, MODEL_IS_SERVER_ONLY_CODE, MODEL_SNAPSHOT_FIELDS_SCAN_CONFIG_FILENAME, MODEL_SNAPSHOT_FIELD_KINDS, MODEL_WRITE_OIDC_SCOPES, MULTIPLE_PAGES_OUTPUT_MODES, ModelSnapshotFieldEntry, ModelSnapshotFieldManifest, ModelSnapshotFieldParamEntry, ModelSnapshotFieldsScanConfig, ModelSnapshotFieldsScanSection, PIPES_SCAN_CONFIG_FILENAME, PIPE_CATEGORIES, PIPE_CATEGORY_ORDER, PIPE_PURITIES, PROMPT_CANCELLED_ERROR_CODE, PipeArgEntry, PipeEntry, PipeManifest, PipesScanConfig, PipesScanSection, RESERVED_MODEL_FOLDERS, ROUTE_MANIFEST_VERSION, ROUTE_MODEL_LIST_TAG, ROUTE_MODEL_TAG, SCAN_CONFIG_FILENAME$1 as SCAN_CONFIG_FILENAME, SERVICE_TOKEN_REQUIRED_OIDC_SCOPES, STANDARD_GLOBAL_OPTION_NAMES, STDIN_NOT_PIPED_ERROR_CODE, SUGGESTED_CLI_LOOPBACK_REDIRECT_PORT, SemanticTypeEntry, SemanticTypeManifest, SemanticTypeScanConfig, TOKEN_ROLES, TOKEN_SOURCES, TokenDefaults, TokenEntry, TokenManifest, UI_COMPONENTS_SCAN_CONFIG_FILENAME, UI_COMPONENT_CATEGORIES, UI_COMPONENT_KINDS, UTILS_SCAN_CONFIG_FILENAME, UTIL_KINDS, UiComponentEntry, UiComponentInputEntry, UiComponentManifest, UiComponentOutputEntry, UiComponentsScanConfig, UiComponentsScanSection, UtilEntry, UtilManifest, UtilParamEntry, UtilsScanConfig, UtilsScanSection, WORKSPACE_AUTH_APPS, WORKSPACE_AUTH_CLAIMS, WORKSPACE_FACTORY_SCAN_EXCLUDE, WORKSPACE_FACTORY_SCAN_INCLUDE, abbreviateMcpCallType, appendCliErrorMapper, applyEnvVarOverrides, assertCliFirestoreQueryCanRun, assertCliFirestoreQueryParentKey, assertCliModelIsNotServerOnly, buildActionCommands, buildActionsManifest, buildAuthorizationUrl, buildCliPaths, buildCssUtilitiesManifest, buildDbxDocsUiExamplesManifest, buildDisambiguatedMcpToolName, buildDispatcherCreditByName, buildDumpFilePath, buildErrorOutput, buildFiltersManifest, buildFirestoreGetCommand, buildFirestoreQueriesCommand, buildFirestoreQueryCommand, buildFirestoreSessionDoctorReadRouting, buildForgeFieldsManifest, buildManifest, buildManifestCommands, buildMcpToolName, buildModelDecodeCommand, buildModelInfoCommand, buildModelSnapshotFieldsManifest, buildPipesManifest, buildRouteManifest, buildRouteTree, buildScanProject, buildUiComponentsManifest, buildUtilsManifest, callModelOverHttp, canonicalCliCacheJson, checkCliDataCacheArgv, clearDownstreamCatalogCache, cliBuildDriftDescription, cliCacheFingerprint, cliDataCacheKey, cliDataCacheMeta, cliDataCacheOptions, cliDataCachePathSegment, cliFirebaseEmulatorsInUse, cliFirestoreAccessorFactory, cliFirestoreBinding, cliFirestoreCollectionForQuery, cliFirestoreErrorMapper, cliFirestoreQueryConstraints, cliFirestoreQueryMode, cliFirestoreQueryModeForRules, cliFirestoreSdkIdentitySuggestion, cliFirestoreSessionEntryExpiresAt, cliFirestoreSessionErrorFactory, cliFirestoreSessionFetcher, cliFirestoreWiringError, cliLifecycleRunner, cliReadResultMeta, closeAllCliFirebaseApps, closeCliFirestoreSessionContext, coerceCliReadVia, collectClassPropertiesWithInheritance, computeRelativeSpecifiers, configureCliDataCacheOptions, configureCliErrorMapper, configureCliSecretPatterns, configureOutputOptions, createActionCommand, createActionRegistry, createActionRegistryFromEntries, createAuthCommand, createAuthMiddleware, createAuthRegistryFromEntries, createCacheCommand, createCallModelCommand, createCli, createCliBuildDriftDoctorCheck, createCliContext, createCliDataCache, createCliFirestoreModels, createCliFirestoreQueryRegistry, createCliFirestoreSessionCacheStore, createCliFirestoreSessionContext, createCliTokenCacheStore, createContextSlot, createCssUtilityRegistry, createCssUtilityRegistryFromEntries, createDbxDocsUiExamplesRegistry, createDbxDocsUiExamplesRegistryFromEntries, createDoctorCommand, createEnvCommand, createFilterRegistry, createFilterRegistryFromEntries, createFirestoreSessionDoctorCheck, createForgeFieldRegistry, createForgeFieldRegistryFromEntries, createModelSnapshotFieldRegistry, createModelSnapshotFieldRegistryFromEntries, createOutputCommand, createOutputMiddleware, createPassthroughAuthMiddleware, createPipeRegistry, createPipeRegistryFromEntries, createSemanticTypeRegistry, createSemanticTypeRegistryFromEntries, createTokenRegistry, createTokenRegistryFromEntries, createUiComponentRegistry, createUiComponentRegistryFromEntries, createUtilRegistry, createUtilRegistryFromEntries, decodeFirestoreModelKey, defaultDoctorChecks, defaultGlobber, defaultReadFile, deriveOptionalFromName, describeCliFirestoreQueryMode, detectDataHelpFormat, detectHelpMode, discoverDownstreamFirebasePackages, discoverDownstreamPackages, discoverOidcMetadata, dumpTimestamp, exchangeAuthorizationCode, expandModelKeys, extractActionEntries, extractAngularInputs, extractAngularOutputs, extractAuthEntries, extractComponentRouteModelTags, extractCssUtilityEntries, extractDbxDocsUiExampleEntries, extractEntries, extractFile, extractFilterEntries, extractForgeFieldEntries, extractModelSnapshotFieldEntries, extractModels, extractPipeEntries, extractUiEntries, extractUrlParamKeys, extractUtilEntries, fetchFirestoreSession, fetchSessionInfo, fetchUserInfo, filterCliFirestoreQueries, filterReadOnlyModelScopes, findAndLoadConfig, findCliEnvDefault, findCliModelManifestEntry, flattenList, formatGeneratedTs, fromCliCacheJson, getBundledManifestsDirectory, getCliContext, getCliEnvVarName, getCliTimeoutMs, getDefaultBundledActionManifestPaths, getDefaultBundledCssUtilityManifestPaths, getDefaultBundledDbxDocsUiExamplesManifestPaths, getDefaultBundledFilterManifestPaths, getDefaultBundledForgeFieldManifestPaths, getDefaultBundledManifestPaths, getDefaultBundledModelFirebaseIndexManifestPaths, getDefaultBundledModelSnapshotFieldManifestPaths, getDefaultBundledPipeManifestPaths, getDefaultBundledTokenManifestPaths, getDefaultBundledUiManifestPaths, getDefaultBundledUtilManifestPaths, getDownstreamCatalog, getFirebaseBucketKeyedByIdModels, getFirebaseDistrictKeyedByIdModels, getFirebaseExternalIdKeyedByIdModels, getFirebaseModel, getFirebaseModelByPrefix, getFirebaseModelGroup, getFirebaseModelGroups, getFirebaseModels, getFirebaseModelsByArchetype, getFirebasePrefixCatalog, getFirebaseRegionKeyedByIdModels, getFirebaseSubcollectionsOf, getFirebaseUserKeyedByIdModels, getFirebaseUserRelatedModels, getModelArchetypeBySlug, getModelArchetypesByAxisValue, getModelArchetypesByCollectionKind, getModelArchetypesBySyncMode, getModelOverFirestore, getModelOverHttp, getMultipleModelsOverFirestore, getMultipleModelsOverHttp, getMultipleModelsOverHttpChunked, getOutputOptions, globToRegex, hasParamSegment, indentLines$1 as indentLines, inspectCliBuildDrift, inspectCliFirestoreSdkIdentity, isCliEnvConfigComplete, isCliFirebaseConfigComplete, isCliFirestoreQueryInvocable, isCliFirestoreSessionExpired, isCliVerbose, isCoreTopic, isEntryExpired, isExportedFromPackage, isStdinPositionalSentinel, isStdinSentinel, isTokenExpired, isVisibleProperty, iterateDbxCliCallModel, loadActionManifests, loadActionRegistry, loadAuthRegistry, loadCliConfig, loadCssUtilityRegistry, loadDbxDocsUiExamplesManifests, loadDbxDocsUiExamplesRegistry, loadFilterManifests, loadFilterRegistry, loadForgeFieldManifests, loadForgeFieldRegistry, loadModelFirebaseIndexManifests, loadModelFirebaseIndexRegistry, loadModelSnapshotFieldManifests, loadModelSnapshotFieldRegistry, loadOrBuildCliCachedData, loadPackageName, loadPipeManifests, loadPipeRegistry, loadRouteTree, loadScanSection, loadSemanticTypeManifests, loadSemanticTypeRegistry, loadTokenManifests, loadTokenRegistry, loadUiComponentManifests, loadUiComponentRegistry, loadUtilManifests, loadUtilRegistry, maskEnv, maskSecret, matchUrlAgainstEntries, mcpManifestKey, mergeCliConfig, mergeCliEnvWithDefault, mergeCliFirebaseConfig, mergeOutputConfig, normalizeCliCacheFilter, normalizePathname, oidcRelyingPartyErrorToCliError, openStreamingDump, openUrlInBrowser, outputError, outputResult, packageNameToSlug, parseAnnotation, parseDeclarations$1 as parseDeclarations, parseFirestoreModelIdentityArgs, parseGetArgs, parseGetManyArgs, parseLoopbackRedirectUri, parsePastedRedirect, parseRouteModelTag, parseScanArgs, pickFields, promptLine, readAllStdin, readCliArtifactPackage, readDirectiveDecorator, readEnvTokenEntry, readPropertyDescription, readSelector, readStdinTokens, readStringProperty, refreshAccessToken, renderCliFirestoreQueryEntry, renderCliFirestoreQueryList, renderDecodedKey, renderGroupedImportLines, renderModelManifestEntry, renderModelManifestFields, renderModelManifestList, renderTable, requireCliContext, requireCliFirestoreContext, requireCliFirestoreModels, requireCliFirestoreSession, resolveActiveEnvName, resolveCliDataCacheOptions, resolveCliEnv, resolveCliEnvOrThrow, resolveCliFirestoreQueryArgs, resolveCliFirestoreQueryEntry, resolveCliModel, resolveCliReadSource, resolveComponentSourceFromSources, resolveDemoClaimsPath, resolveExplicitFirebasePackages, resolveExtendsName, resolveModelArchetype, resolveOutputConfig, resolveOxfmtConfig, resolvePerModelGetKey, resolveRouteSources, revokeToken, runActionsScanCli, runCli, runCliFirestoreQuery, runCssUtilitiesScanCli, runDbxDocsUiExamplesScanCli, runFiltersScanCli, runForgeFieldsScanCli, runModelFirebaseIndexScanCli, runModelSnapshotFieldsScanCli, runPaginatedList, runPipesScanCli, runScanCli, runScanCliBase, runUiComponentsScanCli, runUtilsScanCli, sanitizeString, saveCliConfig, scanFactoryReferences, scoreCandidates, serializeActionManifest, serializeCssUtilityManifest, serializeDbxDocsUiExamplesManifest, serializeFilterManifest, serializeForgeFieldManifest, serializeManifest, serializeModelSnapshotFieldsManifest, serializePipeManifest, serializeUiComponentManifest, serializeUtilManifest, setCliContext, setCliRawArgv, setCliTimeoutMs, setCliVerbose, splitListTagText$1 as splitListTagText, splitSegments, startLoopbackRedirectCapture, stripUrlQueryAndHash, toActionEntryInfo, toCliCacheJson, toFilterEntryInfo, toFormFieldInfo, tracedFetch, truncate, tryMatchSegments, unwrapFenced, validateMcpToolName, verboseLog, withCallModelArgs, withEnv, withMultiplePages, withOutput, withServiceTokenScopes, wrapCommandHandler, wrapSyncCommandHandler, writeGeneratedTsFile };